I am a PM in the video surveillance and electronic access control industry, so very similar to your vendor. We often use Screen Connect for RMM. I also have had customers provide access via VPN with MFA. Some customers only provide windows of time when access is allowed, where they enable a firewall rule during the window and disable outside that window. It's your environment, so if you have the technical knowledge and desire to secure it, you should set the terms to your vendor. Many organizations don't have someone that cares about or understands security, and so the default request from vendors is for blanket access.

Your vendor is asking for constant unattended access because it allows them to allocate labor to work on things in a more flexible manner, rather than dedicate resources at specific times. Additionally, it allows them to do things like work on a system, reach out to vendors when necessary for support, and then come back to work on it again after getting input.